@deffa5556/bail 1.0.6 → 1.0.7

package/cjs/lib/Utils/session-guard.cjs

@@ -0,0 +1,163 @@
+"use strict";
+// ── deffa-baileys: sessionGuard ───────────────────────────────────────────────
+// Fitur keamanan opsional — lock session ke IP server pertama kali connect
+// Cara pakai:
+//   import { sessionGuard } from 'deffa-baileys'
+//   sessionGuard()  ← aktifkan sebelum makeWASocket
+//
+// Kalau tidak dipanggil → tidak ada proteksi (default)
+// ─────────────────────────────────────────────────────────────────────────────
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionGuard = sessionGuard;
+exports.isGuardActive = isGuardActive;
+exports.resetGuard = resetGuard;
+const promises_1 = require("fs/promises");
+const crypto_1 = require("crypto");
+const https_1 = __importDefault(require("https"));
+const path_1 = __importDefault(require("path"));
+const GUARD_FILE = '.deffa_guard';
+let _guardActive = false;
+// ── Ambil IP publik server ────────────────────────────────────────────────────
+function getPublicIP() {
+    return new Promise((resolve) => {
+        const req = https_1.default.get('https://api.ipify.org?format=text', (res) => {
+            let data = '';
+            res.on('data', chunk => data += chunk);
+            res.on('end', () => resolve(data.trim()));
+        });
+        req.on('error', () => {
+            // Fallback: pakai hostname jika gagal ambil IP publik
+            Promise.resolve().then(() => __importStar(require('os'))).then(os => resolve(os.hostname()));
+        });
+        req.setTimeout(5000, () => {
+            req.destroy();
+            Promise.resolve().then(() => __importStar(require('os'))).then(os => resolve(os.hostname()));
+        });
+    });
+}
+// ── Hash IP biar gak tersimpan plaintext ─────────────────────────────────────
+function hashIP(ip) {
+    return (0, crypto_1.createHash)('sha256').update(ip + 'deffa-guard-salt-2025').digest('hex');
+}
+// ── Baca guard file ───────────────────────────────────────────────────────────
+async function readGuard(guardPath) {
+    try {
+        const raw = await (0, promises_1.readFile)(guardPath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+// ── Tulis guard file ──────────────────────────────────────────────────────────
+async function writeGuard(guardPath, data) {
+    await (0, promises_1.writeFile)(guardPath, JSON.stringify(data, null, 2));
+}
+// ── sessionGuard: fungsi utama yang dipanggil user ───────────────────────────
+async function sessionGuard(options = {}) {
+    const { sessionFile = './auth_state.json', // path session WA
+    onBlock = null, // callback kalau diblok
+    silent = false, // sembunyikan log
+     } = options;
+    _guardActive = true;
+    const guardPath = path_1.default.resolve(path_1.default.dirname(path_1.default.resolve(sessionFile)), GUARD_FILE);
+    const log = (...args) => {
+        if (!silent)
+            console.log('[ ✦ ] DEFFA GUARD:', ...args);
+    };
+    log('Mengaktifkan proteksi session...');
+    // Ambil IP sekarang
+    const currentIP = await getPublicIP();
+    const currentHash = hashIP(currentIP);
+    log(`IP Server: ${currentIP}`);
+    // Baca guard file lama
+    const existing = await readGuard(guardPath);
+    if (!existing) {
+        // Pertama kali → simpan IP hash
+        await writeGuard(guardPath, {
+            ipHash: currentHash,
+            createdAt: new Date().toISOString(),
+            version: '1.0.0',
+        });
+        log('Session terdaftar di server ini ✅');
+        return true;
+    }
+    // Cek apakah IP match
+    if (existing.ipHash !== currentHash) {
+        // IP beda → BLOCK
+        const msg = `
+┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
+┃   ⚠️  DEFFA GUARD — SESSION BLOCK  
+┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
+  Session ini tidak bisa digunakan
+  di server ini karena IP berbeda.
+
+  Session hanya bisa berjalan di
+  server tempat session dibuat.
+
+  Jika ini server kamu sendiri,
+  hapus file: ${GUARD_FILE}
+  lalu jalankan ulang bot.
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`;
+        console.error(msg);
+        if (typeof onBlock === 'function') {
+            await onBlock({ currentIP, guardPath });
+        }
+        process.exit(1); // Paksa stop bot
+    }
+    log('IP cocok, session aman ✅');
+    return true;
+}
+// ── isGuardActive: cek apakah guard aktif ────────────────────────────────────
+function isGuardActive() {
+    return _guardActive;
+}
+// ── resetGuard: hapus guard file (kalau mau pindah server secara sah) ────────
+async function resetGuard(sessionFile = './auth_state.json') {
+    const guardPath = path_1.default.resolve(path_1.default.dirname(path_1.default.resolve(sessionFile)), GUARD_FILE);
+    try {
+        const { unlink } = await Promise.resolve().then(() => __importStar(require('fs/promises')));
+        await unlink(guardPath);
+        console.log('[ ✦ ] DEFFA GUARD: Guard direset, silakan jalankan ulang bot.');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/cjs/lib/Utils/signal.cjs

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getNextPreKeysNode = exports.getNextPreKeys = exports.extractDeviceJids = exports.parseAndInjectE2ESessions = exports.extractE2ESessionFromRetryReceipt = exports.xmppPreKey = exports.xmppSignedPreKey = exports.generateOrGetPreKeys = exports.getPreKeys = exports.createSignalIdentity = void 0;
+const index_js_1 = require("../Defaults/index.cjs");
+const index_js_2 = require("../WABinary/index.cjs");
+const crypto_js_1 = require("./crypto.cjs");
+const generics_js_1 = require("./generics.cjs");
+function chunk(array, size) {
+    const chunks = [];
+    for (let i = 0; i < array.length; i += size) {
+        chunks.push(array.slice(i, i + size));
+    }
+    return chunks;
+}
+const createSignalIdentity = (wid, accountSignatureKey) => {
+    return {
+        identifier: { name: wid, deviceId: 0 },
+        identifierKey: (0, crypto_js_1.generateSignalPubKey)(accountSignatureKey)
+    };
+};
+exports.createSignalIdentity = createSignalIdentity;
+const getPreKeys = async ({ get }, min, limit) => {
+    const idList = [];
+    for (let id = min; id < limit; id++) {
+        idList.push(id.toString());
+    }
+    return get('pre-key', idList);
+};
+exports.getPreKeys = getPreKeys;
+const generateOrGetPreKeys = (creds, range) => {
+    const avaliable = creds.nextPreKeyId - creds.firstUnuploadedPreKeyId;
+    const remaining = range - avaliable;
+    const lastPreKeyId = creds.nextPreKeyId + remaining - 1;
+    const newPreKeys = {};
+    if (remaining > 0) {
+        for (let i = creds.nextPreKeyId; i <= lastPreKeyId; i++) {
+            newPreKeys[i] = crypto_js_1.Curve.generateKeyPair();
+        }
+    }
+    return {
+        newPreKeys,
+        lastPreKeyId,
+        preKeysRange: [creds.firstUnuploadedPreKeyId, range]
+    };
+};
+exports.generateOrGetPreKeys = generateOrGetPreKeys;
+const xmppSignedPreKey = (key) => ({
+    tag: 'skey',
+    attrs: {},
+    content: [
+        { tag: 'id', attrs: {}, content: (0, generics_js_1.encodeBigEndian)(key.keyId, 3) },
+        { tag: 'value', attrs: {}, content: key.keyPair.public },
+        { tag: 'signature', attrs: {}, content: key.signature }
+    ]
+});
+exports.xmppSignedPreKey = xmppSignedPreKey;
+const xmppPreKey = (pair, id) => ({
+    tag: 'key',
+    attrs: {},
+    content: [
+        { tag: 'id', attrs: {}, content: (0, generics_js_1.encodeBigEndian)(id, 3) },
+        { tag: 'value', attrs: {}, content: pair.public }
+    ]
+});
+exports.xmppPreKey = xmppPreKey;
+const isValidUInt = (n) => typeof n === 'number' && Number.isInteger(n);
+const extractE2ESessionFromRetryReceipt = (receipt) => {
+    const keysNode = (0, index_js_2.getBinaryNodeChild)(receipt, 'keys');
+    if (!keysNode)
+        return null;
+    const typeBuf = (0, index_js_2.getBinaryNodeChildBuffer)(keysNode, 'type');
+    if (!typeBuf || typeBuf.length !== 1 || typeBuf[0] !== index_js_1.KEY_BUNDLE_TYPE[0])
+        return null;
+    const identity = (0, index_js_2.getBinaryNodeChildBuffer)(keysNode, 'identity');
+    const skey = (0, index_js_2.getBinaryNodeChild)(keysNode, 'skey');
+    if (!identity || identity.length !== 32 || !skey)
+        return null;
+    const registrationId = (0, index_js_2.getBinaryNodeChildUInt)(receipt, 'registration', 4);
+    if (!isValidUInt(registrationId))
+        return null;
+    const signedPubKey = (0, index_js_2.getBinaryNodeChildBuffer)(skey, 'value');
+    const signedSig = (0, index_js_2.getBinaryNodeChildBuffer)(skey, 'signature');
+    const signedKeyId = (0, index_js_2.getBinaryNodeChildUInt)(skey, 'id', 3);
+    if (!signedPubKey || signedPubKey.length !== 32 || !signedSig || !isValidUInt(signedKeyId)) {
+        return null;
+    }
+    const preKeyNode = (0, index_js_2.getBinaryNodeChild)(keysNode, 'key');
+    let preKey;
+    if (preKeyNode) {
+        const preKeyPub = (0, index_js_2.getBinaryNodeChildBuffer)(preKeyNode, 'value');
+        const preKeyId = (0, index_js_2.getBinaryNodeChildUInt)(preKeyNode, 'id', 3);
+        if (!preKeyPub || preKeyPub.length !== 32 || !isValidUInt(preKeyId)) {
+            return null;
+        }
+        preKey = { keyId: preKeyId, publicKey: (0, crypto_js_1.generateSignalPubKey)(preKeyPub) };
+    }
+    return {
+        registrationId,
+        identityKey: (0, crypto_js_1.generateSignalPubKey)(identity),
+        signedPreKey: {
+            keyId: signedKeyId,
+            publicKey: (0, crypto_js_1.generateSignalPubKey)(signedPubKey),
+            signature: signedSig
+        },
+        preKey
+    };
+};
+exports.extractE2ESessionFromRetryReceipt = extractE2ESessionFromRetryReceipt;
+const parseAndInjectE2ESessions = async (node, repository) => {
+    const extractKey = (key) => key
+        ? {
+            keyId: (0, index_js_2.getBinaryNodeChildUInt)(key, 'id', 3),
+            publicKey: (0, crypto_js_1.generateSignalPubKey)((0, index_js_2.getBinaryNodeChildBuffer)(key, 'value')),
+            signature: (0, index_js_2.getBinaryNodeChildBuffer)(key, 'signature')
+        }
+        : undefined;
+    const nodes = (0, index_js_2.getBinaryNodeChildren)((0, index_js_2.getBinaryNodeChild)(node, 'list'), 'user');
+    for (const node of nodes) {
+        (0, index_js_2.assertNodeErrorFree)(node);
+    }
+    // Most of the work in repository.injectE2ESession is CPU intensive, not IO
+    // So Promise.all doesn't really help here,
+    // but blocks even loop if we're using it inside keys.transaction, and it makes it "sync" actually
+    // This way we chunk it in smaller parts and between those parts we can yield to the event loop
+    // It's rare case when you need to E2E sessions for so many users, but it's possible
+    const chunkSize = 100;
+    const chunks = chunk(nodes, chunkSize);
+    for (const nodesChunk of chunks) {
+        for (const node of nodesChunk) {
+            const signedKey = (0, index_js_2.getBinaryNodeChild)(node, 'skey');
+            const key = (0, index_js_2.getBinaryNodeChild)(node, 'key');
+            const identity = (0, index_js_2.getBinaryNodeChildBuffer)(node, 'identity');
+            const jid = node.attrs.jid;
+            const registrationId = (0, index_js_2.getBinaryNodeChildUInt)(node, 'registration', 4);
+            await repository.injectE2ESession({
+                jid,
+                session: {
+                    registrationId: registrationId,
+                    identityKey: (0, crypto_js_1.generateSignalPubKey)(identity),
+                    signedPreKey: extractKey(signedKey),
+                    preKey: extractKey(key)
+                }
+            });
+        }
+    }
+};
+exports.parseAndInjectE2ESessions = parseAndInjectE2ESessions;
+const extractDeviceJids = (result, myJid, myLid, excludeZeroDevices) => {
+    const { user: myUser, device: myDevice } = (0, index_js_2.jidDecode)(myJid);
+    const extracted = [];
+    for (const userResult of result) {
+        const { devices, id } = userResult;
+        const decoded = (0, index_js_2.jidDecode)(id), { user, server } = decoded;
+        let { domainType } = decoded;
+        const deviceList = devices?.deviceList;
+        if (!Array.isArray(deviceList))
+            continue;
+        for (const { id: device, keyIndex, isHosted } of deviceList) {
+            if ((!excludeZeroDevices || device !== 0) && // if zero devices are not-excluded, or device is non zero
+                ((myUser !== user && myLid !== user) || myDevice !== device) && // either different user or if me user, not this device
+                (device === 0 || !!keyIndex) // ensure that "key-index" is specified for "non-zero" devices, produces a bad req otherwise
+            ) {
+                if (isHosted) {
+                    domainType = domainType === index_js_2.WAJIDDomains.LID ? index_js_2.WAJIDDomains.HOSTED_LID : index_js_2.WAJIDDomains.HOSTED;
+                }
+                extracted.push({
+                    user,
+                    device,
+                    domainType,
+                    server: (0, index_js_2.getServerFromDomainType)(server, domainType)
+                });
+            }
+        }
+    }
+    return extracted;
+};
+exports.extractDeviceJids = extractDeviceJids;
+/**
+ * get the next N keys for upload or processing
+ * @param count number of pre-keys to get or generate
+ */
+const getNextPreKeys = async ({ creds, keys }, count) => {
+    const { newPreKeys, lastPreKeyId, preKeysRange } = (0, exports.generateOrGetPreKeys)(creds, count);
+    const update = {
+        nextPreKeyId: Math.max(lastPreKeyId + 1, creds.nextPreKeyId),
+        firstUnuploadedPreKeyId: Math.max(creds.firstUnuploadedPreKeyId, lastPreKeyId + 1)
+    };
+    await keys.set({ 'pre-key': newPreKeys });
+    const preKeys = await (0, exports.getPreKeys)(keys, preKeysRange[0], preKeysRange[0] + preKeysRange[1]);
+    return { update, preKeys };
+};
+exports.getNextPreKeys = getNextPreKeys;
+const getNextPreKeysNode = async (state, count) => {
+    const { creds } = state;
+    const { update, preKeys } = await (0, exports.getNextPreKeys)(state, count);
+    const node = {
+        tag: 'iq',
+        attrs: {
+            xmlns: 'encrypt',
+            type: 'set',
+            to: index_js_2.S_WHATSAPP_NET
+        },
+        content: [
+            { tag: 'registration', attrs: {}, content: (0, generics_js_1.encodeBigEndian)(creds.registrationId) },
+            { tag: 'type', attrs: {}, content: index_js_1.KEY_BUNDLE_TYPE },
+            { tag: 'identity', attrs: {}, content: creds.signedIdentityKey.public },
+            { tag: 'list', attrs: {}, content: Object.keys(preKeys).map(k => (0, exports.xmppPreKey)(preKeys[+k], +k)) },
+            (0, exports.xmppSignedPreKey)(creds.signedPreKey)
+        ]
+    };
+    return { update, node };
+};
+exports.getNextPreKeysNode = getNextPreKeysNode;
+//# sourceMappingURL=signal.js.map

package/cjs/lib/Utils/stanza-ack.cjs

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAckStanza = buildAckStanza;
+/**
+ * Builds an ACK stanza for a received node.
+ * Pure function -- no I/O, no side effects.
+ *
+ * Mirrors WhatsApp Web's ACK construction:
+ * - WAWebHandleMsgSendAck.sendAck / sendNack
+ * - WAWebCreateNackFromStanza.createNackFromStanza
+ */
+function buildAckStanza(node, errorCode, meId) {
+    const { tag, attrs } = node;
+    const stanza = {
+        tag: 'ack',
+        attrs: {
+            id: attrs.id,
+            to: attrs.from,
+            class: tag
+        }
+    };
+    if (errorCode) {
+        stanza.attrs.error = errorCode.toString();
+    }
+    if (attrs.participant) {
+        stanza.attrs.participant = attrs.participant;
+    }
+    if (attrs.recipient) {
+        stanza.attrs.recipient = attrs.recipient;
+    }
+    // WA Web always includes type when present: `n.type || DROP_ATTR`
+    if (attrs.type) {
+        stanza.attrs.type = attrs.type;
+    }
+    // WA Web WAWebHandleMsgSendAck.sendAck/sendNack always include `from` for message-class ACKs
+    if (tag === 'message' && meId) {
+        stanza.attrs.from = meId;
+    }
+    return stanza;
+}
+//# sourceMappingURL=stanza-ack.js.map

package/cjs/lib/Utils/sync-action-utils.cjs

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emitSyncActionResults = exports.processContactAction = void 0;
+const index_js_1 = require("../../WAProto/index.cjs");
+const index_js_2 = require("../WABinary/index.cjs");
+/**
+ * Process contactAction and return events to emit.
+ * Pure function - no side effects.
+ */
+const processContactAction = (action, id, logger) => {
+    const results = [];
+    if (!id) {
+        logger?.warn({ hasFullName: !!action.fullName, hasLidJid: !!action.lidJid, hasPnJid: !!action.pnJid }, 'contactAction sync: missing id in index');
+        return results;
+    }
+    const lidJid = action.lidJid;
+    const idIsPn = (0, index_js_2.isPnUser)(id);
+    // PN is in index[1], not in contactAction.pnJid which is usually null
+    const phoneNumber = idIsPn ? id : action.pnJid || undefined;
+    // Always emit contacts.upsert
+    results.push({
+        event: 'contacts.upsert',
+        data: [
+            {
+                id,
+                name: action.fullName || action.firstName || action.username || undefined,
+                username: action.username || undefined,
+                lid: lidJid || undefined,
+                phoneNumber
+            }
+        ]
+    });
+    // Emit lid-mapping.update if we have valid LID-PN pair
+    if (lidJid && (0, index_js_2.isLidUser)(lidJid) && idIsPn) {
+        results.push({
+            event: 'lid-mapping.update',
+            data: { lid: lidJid, pn: id }
+        });
+    }
+    return results;
+};
+exports.processContactAction = processContactAction;
+const emitSyncActionResults = (ev, results) => {
+    for (const result of results) {
+        if (result.event === 'contacts.upsert') {
+            ev.emit('contacts.upsert', result.data);
+        }
+        else {
+            ev.emit('lid-mapping.update', result.data);
+        }
+    }
+};
+exports.emitSyncActionResults = emitSyncActionResults;
+//# sourceMappingURL=sync-action-utils.js.map

package/cjs/lib/Utils/tc-token-utils.cjs

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TC_TOKEN_INDEX_KEY = void 0;
+exports.readTcTokenIndex = readTcTokenIndex;
+exports.buildMergedTcTokenIndexWrite = buildMergedTcTokenIndexWrite;
+exports.isTcTokenExpired = isTcTokenExpired;
+exports.shouldSendNewTcToken = shouldSendNewTcToken;
+exports.resolveTcTokenJid = resolveTcTokenJid;
+exports.resolveIssuanceJid = resolveIssuanceJid;
+exports.buildTcTokenFromJid = buildTcTokenFromJid;
+exports.storeTcTokensFromIqResult = storeTcTokensFromIqResult;
+const index_js_1 = require("../WABinary/index.cjs");
+// Same phone-number pattern as WABinary's isJidBot, applied against the user
+// part so the check is invariant to @c.us ↔ @s.whatsapp.net normalization.
+const BOT_PHONE_REGEX = /^1313555\d{4}$|^131655500\d{2}$/;
+/**
+ * Mirrors WA Web's `Wid.isRegularUser()` (user ∧ ¬PSA ∧ ¬Bot). Used to gate tctoken
+ * storage against malformed notifications — WA Web filters server-side but we
+ * defend here for parity with `WAWebSetTcTokenChatAction.handleIncomingTcToken`.
+ * Works for both pre- and post-normalized JIDs (`@c.us` vs `@s.whatsapp.net`).
+ */
+function isRegularUser(jid) {
+    if (!jid)
+        return false;
+    const user = jid.split('@')[0] ?? '';
+    if (user === '0')
+        return false; // PSA
+    if (BOT_PHONE_REGEX.test(user))
+        return false; // Bot by phone pattern
+    if ((0, index_js_1.isJidMetaAI)(jid))
+        return false; // MetaAI (@bot server)
+    return !!((0, index_js_1.isPnUser)(jid) || (0, index_js_1.isLidUser)(jid) || (0, index_js_1.isHostedPnUser)(jid) || (0, index_js_1.isHostedLidUser)(jid) || jid.endsWith('@c.us'));
+}
+const TC_TOKEN_BUCKET_DURATION = 604800; // 7 days
+const TC_TOKEN_NUM_BUCKETS = 4; // ~28-day rolling window
+/** Sentinel key under `tctoken` store holding a JSON array of tracked storage JIDs for cross-session pruning. */
+exports.TC_TOKEN_INDEX_KEY = '__index';
+/** Read the persisted tctoken JID index and return its entries (never contains the sentinel key itself). */
+async function readTcTokenIndex(keys) {
+    const data = await keys.get('tctoken', [exports.TC_TOKEN_INDEX_KEY]);
+    const entry = data[exports.TC_TOKEN_INDEX_KEY];
+    if (!entry?.token?.length)
+        return [];
+    try {
+        const parsed = JSON.parse(Buffer.from(entry.token).toString());
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((j) => typeof j === 'string' && j.length > 0 && j !== exports.TC_TOKEN_INDEX_KEY);
+    }
+    catch {
+        return [];
+    }
+}
+/** Build a SignalDataSet fragment that writes the merged index (persisted ∪ added) under the sentinel key. */
+async function buildMergedTcTokenIndexWrite(keys, addedJids) {
+    const persisted = await readTcTokenIndex(keys);
+    const merged = new Set(persisted);
+    for (const jid of addedJids) {
+        if (jid && jid !== exports.TC_TOKEN_INDEX_KEY)
+            merged.add(jid);
+    }
+    return {
+        [exports.TC_TOKEN_INDEX_KEY]: { token: Buffer.from(JSON.stringify([...merged])) }
+    };
+}
+// WA Web has separate sender/receiver AB props for these but they're identical today
+function isTcTokenExpired(timestamp) {
+    if (timestamp === null || timestamp === undefined)
+        return true;
+    const ts = typeof timestamp === 'string' ? parseInt(timestamp) : timestamp;
+    if (isNaN(ts))
+        return true;
+    const now = Math.floor(Date.now() / 1000);
+    const currentBucket = Math.floor(now / TC_TOKEN_BUCKET_DURATION);
+    const cutoffBucket = currentBucket - (TC_TOKEN_NUM_BUCKETS - 1);
+    const cutoffTimestamp = cutoffBucket * TC_TOKEN_BUCKET_DURATION;
+    return ts < cutoffTimestamp;
+}
+function shouldSendNewTcToken(senderTimestamp) {
+    if (senderTimestamp === undefined)
+        return true;
+    const now = Math.floor(Date.now() / 1000);
+    const currentBucket = Math.floor(now / TC_TOKEN_BUCKET_DURATION);
+    const senderBucket = Math.floor(senderTimestamp / TC_TOKEN_BUCKET_DURATION);
+    return currentBucket > senderBucket;
+}
+/** Resolve JID to LID for tctoken storage (WA Web stores under LID) */
+async function resolveTcTokenJid(jid, getLIDForPN) {
+    if ((0, index_js_1.isLidUser)(jid))
+        return jid;
+    const lid = await getLIDForPN(jid);
+    return lid ?? jid;
+}
+/** Resolve target JID for issuing privacy token based on AB prop 14303 */
+async function resolveIssuanceJid(jid, issueToLid, getLIDForPN, getPNForLID) {
+    if (issueToLid) {
+        if ((0, index_js_1.isLidUser)(jid))
+            return jid;
+        const lid = await getLIDForPN(jid);
+        return lid ?? jid;
+    }
+    if (!(0, index_js_1.isLidUser)(jid))
+        return jid;
+    if (getPNForLID) {
+        const pn = await getPNForLID(jid);
+        return pn ?? jid;
+    }
+    return jid;
+}
+async function buildTcTokenFromJid({ authState, jid, baseContent = [], getLIDForPN }) {
+    try {
+        const storageJid = await resolveTcTokenJid(jid, getLIDForPN);
+        const tcTokenData = await authState.keys.get('tctoken', [storageJid]);
+        const entry = tcTokenData?.[storageJid];
+        const tcTokenBuffer = entry?.token;
+        if (!tcTokenBuffer?.length || isTcTokenExpired(entry?.timestamp)) {
+            if (tcTokenBuffer) {
+                // Preserve senderTimestamp so shouldSendNewTcToken() keeps its dedupe state
+                // after we drop the unusable peer token. Only wipe the record entirely when
+                // there's nothing worth keeping.
+                const cleared = entry?.senderTimestamp !== undefined
+                    ? { token: Buffer.alloc(0), senderTimestamp: entry.senderTimestamp }
+                    : null;
+                await authState.keys.set({ tctoken: { [storageJid]: cleared } });
+            }
+            return baseContent.length > 0 ? baseContent : undefined;
+        }
+        baseContent.push({
+            tag: 'tctoken',
+            attrs: {},
+            content: tcTokenBuffer
+        });
+        return baseContent;
+    }
+    catch (error) {
+        return baseContent.length > 0 ? baseContent : undefined;
+    }
+}
+async function storeTcTokensFromIqResult({ result, fallbackJid, keys, getLIDForPN, onNewJidStored }) {
+    const tokensNode = (0, index_js_1.getBinaryNodeChild)(result, 'tokens');
+    if (!tokensNode)
+        return;
+    const tokenNodes = (0, index_js_1.getBinaryNodeChildren)(tokensNode, 'token');
+    for (const tokenNode of tokenNodes) {
+        if (tokenNode.attrs.type !== 'trusted_contact' || !(tokenNode.content instanceof Uint8Array)) {
+            continue;
+        }
+        // In notifications tokenNode.attrs.jid is your own device JID, not the sender's
+        const rawJid = (0, index_js_1.jidNormalizedUser)(fallbackJid || tokenNode.attrs.jid);
+        if (!isRegularUser(rawJid))
+            continue;
+        const storageJid = await resolveTcTokenJid(rawJid, getLIDForPN);
+        const existingTcData = await keys.get('tctoken', [storageJid]);
+        const existingEntry = existingTcData[storageJid];
+        const existingTs = existingEntry?.timestamp ? Number(existingEntry.timestamp) : 0;
+        const incomingTs = tokenNode.attrs.t ? Number(tokenNode.attrs.t) : 0;
+        // timestamp-less tokens would be immediately expired
+        if (!incomingTs)
+            continue;
+        if (existingTs > 0 && existingTs > incomingTs)
+            continue;
+        await keys.set({
+            tctoken: {
+                [storageJid]: {
+                    ...existingEntry,
+                    token: Buffer.from(tokenNode.content),
+                    timestamp: tokenNode.attrs.t
+                }
+            }
+        });
+        onNewJidStored?.(storageJid);
+    }
+}
+//# sourceMappingURL=tc-token-utils.js.map